Etherpad's `/tokenTransfer` endpoint pair allows a logged-in user to transfer their HttpOnly author token to another browser via a UUID-based URL. The implementation has three critical issues: no expiration on the transfer UUID, no single-use enforcement allowing repeated redemptions, and the author token is returned in cleartext in the JSON response body. These flaws enable an attacker who obtains the UUID through any leakage vector (e.g., browser history, intercepted QR code) to repeatedly redeem the token and fully impersonate the author. The vulnerability affects versions >=2.6.0 and <=3.0.0 and is fixed in version 3.1.0 by adding a 5-minute TTL, enforcing single-use by deleting the record upon redemption, and removing the token from the response body.

An attacker who obtains the transfer UUID can remotely and repeatedly impersonate the author account by redeeming the token transfer URL. This leads to full compromise of the author's identity, including read and write access to all author capabilities. The vulnerability requires the attacker to learn the UUID through some out-of-band means but does not require authentication at the redemption endpoint. There is no denial-of-service impact. The CVSS 3.1 score is 6.8 (medium severity) with high confidentiality and integrity impact.

A patch is available in ep_etherpad-lite version 3.1.0 that enforces a 5-minute expiration on transfer tokens, single-use redemption, and removes the author token from the response body. Operators should upgrade to version 3.1.0 or later to fully remediate the issue. Workarounds such as disabling UI elements that expose the transfer URL, blocking the `/tokenTransfer/*` endpoint via reverse proxy, or setting short database cleanup intervals are incomplete and do not address all flaws. Upgrade is the only complete fix.